Malicious code in @webapp-next/store (npm)
The npm package @webapp-next/store contained malicious code that executed automatically on installation, collecting system and user information and exfiltrating it to an attacker-controlled server. The package had no legitimate functionality and used a dependency-confusion lure with a scope resembling a legitimate namespace.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed @webapp-next/store via npm
- Ecosystems
- Attack vectors
- Affected entities
- @webapp-next/storenpm package containing malicious preinstall script
The npm package @webapp-next/store was published with malicious code designed to execute automatically during installation. The package.json declared a preinstall script that ran node index.js on npm install, triggering data exfiltration without user consent.
The index.js payload collected sensitive system and user information including hostname, platform, architecture, home directory, user credentials (username, uid, gid, shell), OS release/memory/CPU details, current working directory, and the output of shell commands whoami and id. This aggregated data was then POSTed to https://oia2jeijtfmt053ynp686t5riioac00p.oastify.com/testbydext, a Burp Suite Collaborator out-of-band interaction subdomain controlled by the attacker.
The package contained no legitimate functionality—only the exfiltration payload. The use of the @webapp-next scope, which resembles a legitimate namespace, combined with the lack of author/description metadata, indicates a dependency-confusion attack designed to lure developers into installing the malicious package.
The incident was identified and reported by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @webapp-next/store
- Domains
- oia2jeijtfmt053ynp686t5riioac00p.oastify.com
Remediation
- Immediately uninstall @webapp-next/store from all systems and projects
- Audit npm install logs to identify when the package was installed and on which systems
- Assume any system that installed this package has been compromised; review for unauthorized access and data exfiltration
- Change credentials (passwords, SSH keys, API tokens) for any user accounts on affected systems
- Monitor network traffic from affected systems for suspicious outbound connections
- Use npm audit to check for other malicious packages in your dependency tree
- Consider using npm package signing verification and private registries to prevent dependency-confusion attacks
Sources
- GitHub Advisory GHSA-9frp-9f8j-wj97 · GitHub Advisory Database
Cite this entry
"Malicious code in @webapp-next/store (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-webapp-next-store-npm-a983us
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @pelmnaads/naads-common-logger (npm)
Malicious code in @pelmnaads/naads-common-logger (npm) version 19999.0.1 exploited dependency confusion by publishing to the public npm registry with an abnormally high version number. A preinstall script transmitted installer hostname data to a Burp Collaborator endpoint (h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com), silently exfiltrating build host identity.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in @convera/ui-shared (npm)
The npm package @convera/ui-shared version 0.0.2 contained malicious code that exfiltrated system hostname and username during installation via a preinstall script. The package was published under a private namespace scope, creating a dependency-confusion attack surface against the Convera organization.
npmCompromised packageDependency confusion - containedcritical
Malicious code in secdriven (npm)
The npm package 'secdriven' version 1.0.8 contains malicious postinstall code that exfiltrates host identity, username, working directory, and CI environment variables to a third-party OOB-detection endpoint. The package is a dependency-confusion payload targeting Google's internal namespace, masquerading as a security research canary.
npmDependency confusionCompromised package - containedcritical
Malicious code in @design-system-coopeuch/web (npm)
@design-system-coopeuch/web versions 999.0.4 and 999.0.0 on npm contained malicious code implementing a dependency-confusion attack. The package included a preinstall hook that exfiltrated host identifiers (hostname, working directory, user ID, environment variables) to a hardcoded IP address via cleartext HTTP.
npmDependency confusionCompromised package